I can follow the backtrace before that through my patch, starting at the [timepoint] object (line 30 in the backtrace) through [trigger]s, [route]s, etc. Based on the layout of my patch, where this crash occurs is either:

Just as the message is entering a [patcher]

OR, just as the message is exiting the current patcher (which is an abstraction, embedded in another abstraction) via an [outlet]

But I don't know what typedmess_lookup() or object_attr_method() are doing, either.

As far as I know, typedmess_lookup() is a method used by Max in order to determine if a message arriving at an object is a bang, float, int or something else, so that it can pass it on to the correct method of the object.

I would suspect that you might have an invalid pointer at this point (e.g. a pointer to NULL), and this cause it to crash. If so, it might be that the real root of the issue is located elsewhere, but that the invalid message is being passed around for a while before it eventually explodes.

Apart from that, if this crash happens in an external of yours, another thing that you might try, is a similar fix to one we did some years ago when we had a related crash. You can find the commit log for that fix here: